|
As we move through the second half of the year, we’re keeping a close eye on the developments shaping the EMS, healthcare, and employment law landscape. In this issue, we’ll share key updates from the past quarter, highlight trends that may impact your organization, and provide practical insights to help you stay ahead.
Our goal remains the same: to keep you informed with timely, relevant, and actionable guidance tailored to the challenges you face every day.
| | Our Newest Team Members: Welcome! | | |
Last quarter, we introduced Daniel Pedersen, Esq., to Werfel, Moore, & Kelly Law Group, as well as Shawn Baird, Senior Consultant, to the Werfel, Moore, & Kelly Consulting Group team.
Collectively, they bring a wealth of knowledge and experience, and we are thrilled to have them as an asset to our growing firm.
| | Dan is a Pennsylvania-based attorney who has nearly 25 years of experience in healthcare law, the majority of which involves representing the EMS industry. Dan's areas of practice largely focus on Medicare and other insurance programs' reimbursement rules, Federal law and regulatory compliance, and HIPAA. He has saved dozens of clients millions of dollars by successfully pursuing appeals from post-payment audits, and has experience in assisting clients with OIG-related matters. Dan is also a frequent conference presenter and contributor to EMS publications. | | Shawn brings more than 35 years of experience in emergency medical services across every level of the industry. Based in the PNW, he is a nationally recognized EMS leader with a proven record of service and innovation. Shawn will be supporting our expanded scope of services with AAA and state associations on critical legislative and regulatory initiatives, impacting ground ambulance services. He will expand our consulting services to assist with the development and implementation of policies such as balance billing, EMS as an essential service, Medicaid finance, and rural transformation grants. | | Client Advisory Highlights: Last Quarter in Review | | |
What the OBBBA May Mean for the EMS Workplace
There has been a fair amount of chatter and content from various groups about the One Big Beautiful Bill Act (OBBBA) and the impacts on EMS organizations and their employees. It is important to recognize that many of the specific details about how some of the provisions in the Bill may be implemented have yet to be determined. Most importantly, multiple elements will require further regulatory guidance and administrative rulemaking before they fully come into practical play. (Scott Moore, Esq.)
Read more.
| |
Ford Issues Recall Notice for Numerous Vehicle Models for Stalling Due to Fuel Pump Defect
In July 2025, Ford Motor Company issued a major safety recall affecting more than 850,000 vehicles from model years 2021 through 2023. The issue is impacting F-Series Trucks, Mustangs, Broncos, and Lincoln SUVs. The recall was issued following over 2,000 warranty claims related to a fuel pump defect that can lead to sudden engine stalling. The recall, filed under NHTSA Campaign Number 25V-455, involves a range of Ford and Lincoln vehicles and highlights a manufacturing defect that may significantly compromise vehicle safety. We were informed of this recall from an AAA member whose ambulance experienced the fuel pump failure identified in this recall.
It is important to note, this recall is unrelated to the Ford 7.3 Liter low engine pressure issue the AAA notified members of back in May 2025. Resources for addressing the low oil pressure issue can be found on the AAA website. (Scott Moore, Esq.)
Read more.
| | Legal Answers: Ask the Attorney | | |
On January 1, 2025, Medicare expanded the list of interventions that qualify for ALS2 level billing by adding blood product administration to the list of skills (in addition to things like endotracheal intubation, intraosseous line, central venous line, and surgical airway). This change, however, prompted several questions about this list of skills, and whether such skills must be initiated by the ambulance crew, or could be performed by someone else, and simply monitored by the ambulance crew. Indeed, the definition of ALS2 (from 42 CFR §414.605) notes that ALS requires “the provision of” one of the specific interventions. Medicare offered some clarification regarding the administration of blood products in the Medicare Benefit Policy Manual (100-02), Chapter 10, Section 30.1.1, by suggesting that monitoring of WBT can qualify for ALS2 billing. Interestingly, this same Manual provision also noted that monitoring (and not actual performance) of an existing endotracheal intubation can also qualify for ALS2.
However, when that Manual provision was revised in July, the previous guidance was effectively removed, and the new guidance about blood products was added. We believe the removal of the other guidance language was inadvertent and are awaiting CMS to re-insert this important ALS2 guidance and application language. From a compliance perspective, we suggest billing ALS2 only where the skill was performed by the paramedic, with exceptions for monitoring only for WBT blood products and ET monitoring. All other skills should be performed by the EMS crew directly to qualify for ALS2 billing. Of course, in a Medicare audit situation, where a reviewer tries to down-code an ALS2-billed trip to ALS because an ALS2 skill was merely monitored, there are certainly reasonable arguments to make to support that such monitoring should be extended to all ALS2 skills. (Daniel Pedersen, Esq.)
| | Risk Watch: Compliance & Enforcement Trends | | |
The Causes, Consequences and Prevention of a Data Breach
Data breaches continue to be a significant risk for healthcare providers, including EMS agencies, several of which have made national headlines over the past few years. The average cost of a data breach is $9.7 million according to The HIPAA Journal. But where exactly does the financial risk stem from which results in this almost eight-figure expense?
The first factor is the cause of the breach itself. If the data has been accessed in a hacking event, the attacker will often encrypt the data and demand a ransom for its release. These ransom demands started out in the mid six-figure range years ago, but have now climbed well into the millions just to have access to your data restored.
The next factor is that a security incident involving a large number of patients will trigger an obligation to report to the Office of Civil Rights (“OCR”). The OCR will in turn initiate an investigation into the incident. One of the first things they will ask for is your Risk Analysis and general proof of HIPAA compliance. If you have not met their expectations, a fine is very likely. These fines are capped at $1.5 million annually, but if there has been long-standing non-compliance, the penalties can be assessed for multiple years.
The OCR will release the security incident report to the public, and you may also have public notice obligations. This public awareness of the incident generates class action lawsuits in a matter of weeks, if not days. These suits often generate a settlement with a year of credit monitoring and a cap on per-person damages of $2k-$5k, plus an attorney fee of several million dollars.
Regardless of the public notice, you also have to notify the individual patients in writing, usually by mail, which creates an additional expense; think somewhere around $2 per patient. With some breaches involving hundreds of thousands of patients, just providing the notices can run up the damages substantially.
So you pay the hacker ransom, you pay the post office for stamps, you pay the HHS OCR for fines, you pay the patients for damages, you pay their lawyers for filing the suit, and you pay for HIPAA compliance and data security measures going forward. The resulting cost of a breach that impacts a large number of patients is enormous. The next question is how can you limit the potential damage?
Secure your data to limit hackers’ ability to access it. Consider use of multi-factor authentication, remote tracking and access to portable electronic devices, and encrypted hard drives. Keep your software up to date to ensure you have the most recent security patches. Also make sure to back-up your data frequently, so that it can be restored in the event it is lost, compromised, or locked up by a hacker.
Train your workforce on how to recognize phishing scams and general email security. Post HIPAA reminders around the office and in your ambulances to keep awareness and proper procedures in the front of the minds of your staff.
Limit the amount of patient data stored in one place to limit the number of individuals who must receive notice, and potentially limit the data breach from going public or being large enough to attract class action lawyers. Consider cloud-based storage and limiting the amount of information stored on local devices.
Conduct a risk assessment annually and have it ready to provide to the OCR to avoid fines. A tool for a compliant risk assessment can be found here: Security Risk Assessment Tool | HealthIT.gov. If you need HIPAA policies reviewed or updated, let us know.
Consider cyber insurance. Most policies will not cover $9M in losses, but if you take the steps above and limit your exposure you may not need an excessive amount of coverage. As a bonus, with many plans coverage also comes with training and response resources. (Christopher Kelly, Esq.)
| | Workplace 360: Employment Law & HR Guidance | | |
Ensuring Compliance with FSLA Weighted Average Overtime
In recent weeks, EMS leaders have likely seen solicitation on social media, fliers, emails, and phone calls from law firms promoting potential lawsuits against ambulance services and other healthcare employers for alleged wage and hour violations. One of the hottest issues driving these solicitations is overtime compliance. Specifically, the FLSA the requirement to calculate overtime based on a weighted average of all rates paid to an employee in a workweek.
This is not a new rule, but a long-standing requirement under the Fair Labor Standards Act (FLSA). Over the last few years, EMS operations have increasingly offered multiple pay rates and staffing incentives, such as differentials for night shifts, weekends, or separate rates for special events. We believe ambulance providers are among a vulnerable group of employers due to the popularity of these pay practices.
We have been advising clients about these requirements for several years. Additionally, we have highlighted this as part of our client policy review. For our clients who are AAA members, the AAA HR Handbook is free as part of their Membership. The sample policy titled Compensation & Pay has multiple Practice Notices alerting employers of this requirement. (Scott Moore, Esq.)
Read more.
| | |
Social Media and Free Speech in an EMS Workplace
Emergency Medical Services (EMS) professionals are often called upon to serve their communities in highly visible, high-stress roles. EMS professionals have a front seat to the consequences of the more socially and politically charged environment we operate in today. Alongside the professional and clinical responsibilities of the job, EMS personnel, like all employees, also must navigate the boundaries of their rights to free expression. This is especially true in an era where personal opinions, frustrations, and experiences are frequently shared on social media. (Scott Moore, Esq.)
Read more.
| | PSA: Beware of Bad Information | | |
Beware of Who You Get Your Information From
As the Halloween season is upon us, our kids will soon willingly (and through parental encouragement) accept candy from strangers. Yet, throughout the rest of the year, we remind our youth to avoid these tasty treats from strangers. It’s an odd paradox that also seems to apply to information we receive in EMS. Confused as to where this might be going, let’s explain:
On September 17, 2025, CMS hosted the second “National A/B MAC Ambulance Provider/Supplier Coalition Meeting.” This 90-minute webinar featured representatives from each MAC, in round-robin style, providing answers to pre-submitted questions about matters concerning ambulance billing and compliance. The information provided by the MACs was a mixed bag of goodies - just like Halloween. There was some good stuff, like answers that were accurate and gave proper citations about ambulance billing (the King-sized Hershey Bar for the Halloween comparison), and some not-so-good stuff, like butchering basic regulatory definitions and causing mass confusion (what is “Bit-O-Honey” Halloween candy anyway – it doesn’t even taste like honey!).
The point is, the fact that CMS might join the MACs together to offer such a “Coalition Meeting” does not mean that the information provided will be any better than the incomplete, confusing, inapplicable, and contradictory guidance MAC representatives might offer any other time of the year. We must not become so complacent as to be willing to “accept” information from our illustrious MACs as the truth, or think the information is “better” because of the method in which it is delivered. We must always be cautious with the information we receive or, in the very least, double-check the information for accuracy. Just because it’s offered in a perceived “safe setting” doesn’t mean it’s really safe.
Therefore, getting back to the Halloween analogy for a second. There was a time when, despite the fact that our parents allowed us to accept candy from strangers, there was still a check-and-balance process in place. Remember when our parents had to check the candy to make sure it wasn’t tampered with before we were allowed to eat it? The same thing applies here. Let’s all be careful of the information that we consume from our MAC representatives, and even have a bit of a check-and-balance process in place. If something doesn’t seem right: verify. If one MAC says one thing, but another says something else, find the source of the confusion. If you are aware of written guidance that contradicts what the MAC said, verbally challenge them.
Bottom Line
When receiving information from even those who are supposed to be “experts,” you need to play the role of the parent at Halloween by confirming the integrity of the information before it’s consumed. Just as tainted candy will make you sick, tainted information can lead to big compliance problems as well. (Daniel Pedersen, Esq.)
| | Legal Landscape: State Law Watch | | |
We introduce this as a new portion of our Quarterly Newsletter, so its content is still evolving. In the future, we might highlight new and noteworthy state laws of which we become aware or provide updates to state laws and regulations to the states we are admitted to practice (MA, IL, NY, TN, PA, TX, MN, ND, SC). However, for this inaugural post, we highlight two important concepts affecting all states and offer some resources on where to find more information about these important concepts.
First, thanks to the federal No Surprises Act (“NSA”), state law prohibitions against “balance billing” are all the rage. Of course, it’s important to consider what is (and isn’t) balance billing. Balance billing does not include legitimate cost-sharing amounts (for which the patient can be held financially responsible after insurance pays its portion). It also should not apply to those cases where insurance does not pay at all (i.e., the service is not covered, such that the patient can be held financially responsible for the full charges). Instead, such balance billing prohibition laws are intended to prevent billing the patient the difference between what the provider charged and the insurer's “allowed amount” (again, with specific allowances for cost-sharing to be lawfully recovered). Such balance billing laws apply in non-contracted situations. An entity known as the Commonwealth Fund does a great job at tracking the current state of affairs with the balance billing laws of the 50 states, including an interactive map to find specific laws, restrictions, and exceptions for each state. Many states have such balance billing laws, but carve out exceptions for EMS, or treat emergency and non-emergency transports differently. Don’t fall into a trap where some payer claims that balance billing laws apply. Instead, know the law, and know your rights. Don’t give up your legal right to balance bill a patient if the law allows for such.
Second (again, thanks to some recent federal law changes, far more complicated to get involved with here), the concept of “Medicaid disenrollment” has also been a hot topic as of late. Briefly, as part of an effort to re-evaluate Medicaid eligibility in the states, to ensure that people receiving Medicaid benefits indeed meet the criteria for such benefits, states have been systematically “disenrolling” patients. In many cases, those patients qualify to re-enroll (sometimes retroactively, but sometimes leaving a gap in coverage). An entity known today simply as KFF (formerly referred to as the Kaiser Family Foundation – with no affiliation to Kaiser Permanente) has tracked the Medicaid disenrollment and so-called “unwinding” with various statistics and data about the overall process. Check out the comprehensive data about your state (and others), here. If you’re struggling with Medicaid reimbursement and finding that more patients (who used to have Medicaid benefits) are no longer covered, this disenrollment effort might be the reason. (Daniel Pedersen, Esq.)
| | Legal Pulse: EMS Law & Regulation Updates | | |
The good news is that we are not aware of any EMS-specific items brewing in Congress or among the various Federal Departments (CMS, OIG, DOJ, etc.). The bad news is that we are not aware of any EMS-specific items brewing. Why is that bad?
September 30, 2025, marked the last day of the Medicare ambulance extenders – the 2%, 3%, and 22.6% add-on bonus amounts for urban, rural, and super rural, respectively. As you may know, these “add-on payments” or “extenders” have been around for quite some time, usually set to expire (or sunset) at the end of a calendar year. Often, Congress extends such bonus payments near the end of the calendar year, usually tied to an economic budget package (e.g., Omnibus Budget Reconciliation Act). Most recently, these bonus payments were again “extended” for ambulance reimbursement. Initially set to expire on March 30, 2025, HR 1968 was passed by Congress on March 14, 2025, and signed by the President on March 15, extending these bonus payments through September 30, 2025. HR 2232 was introduced on March 18, 2025, proposing to extend the bonus payments through January 1, 2028. This effort stalled, and the bonus payments have again “sunset.”
Stay tuned for more news and updates on these important bonus payment “extenders.” (Daniel Pedersen, Esq.)
| | |
New Reporting Requirements for Part 2 Programs
Beginning February 16, 2026, programs subject to 42 CFR Part 2 ("Part 2") will be required to report unauthorized disclosures of substance use disorder (SUD) treatment information, even when those disclosures wouldn’t violate HIPAA.
Part 2 is a set of federal regulations that protect the confidentiality of SUD treatment records. Some community paramedicine or mobile integrated health programs may veer into Part 2 territory without realizing it, especially if they are involved in screening, diagnosing, or referring individuals for substance use disorder treatment.
To determine whether or not you are a Part 2 program, you must evaluate whether you meet both prongs of the definition:
- The program must be federally assisted. This is a broad category that will capture nearly all entities.
- The program must hold itself out as providing and actually provide SUD diagnosis, treatment, or referral for treatment.
If both apply, your program is considered a Part 2 program and must follow Part 2’s strict privacy rules.
The upcoming changes mean that even if a disclosure of patient information is allowed under HIPAA, it could still be a violation under Part 2 if the proper patient consent is not obtained. For example, a Part 2 program that is also a HIPAA-covered entity cannot send patient care information containing SUD-related details to another provider without a signed patient consent explicitly allowing for such disclosure. Although HIPAA permits disclosures for treatment purposes without consent, Part 2 does not allow for disclosure without a signed patient consent.
Starting on February 16, 2026, Part 2 programs will be legally required to apply the HIPAA breach standard to violations of Part 2 and report them accordingly. Enforcement authority will rest with the Office for Civil Rights (OCR), which can impose civil monetary penalties, enter into resolution agreements, and require corrective action plans.
If your program falls under Part 2, now is the time to review your patient consent procedures and breach response policies. Strengthening these areas will help reduce the risk of accidental disclosures and ensure your organization is in compliance before the new rules take effect. (Adam Parker, Of Counsel)
| | Resources: Quick Tools & Templates | | |
The team at Newton 360 is committed to improving the EMS and public safety workplace. That is why we have developed a tool to improve the working relationships and work environment for those in our profession. We believe that there is no cause nobler than serving others and helping those in need. This includes our own team members. To that end, a portion of every Newton 360 license fee is donated to The Code Green Campaign. Our hope is to lend a hand and be part of the solution for the challenges facing individual EMS professionals and organizations who employ them.
We hope that you subscribe to Newton 360 and join our customers in trying to change the daily working experience for all who work in EMS and the larger public safety field. However, if your organization is not ready to become a Newton 360, we strongly encourage you to donate to The Code Green Campaign.
| | |
Conference Engagements
Catch up with us at the following EMS events!
Events that we will be presenting at are indicated with a *
| | New to Werfel, Moore, & Kelly Law Group? We'd love to work with you! Contact us by clicking the button below for a free consultation or to start your comprehensive HR Audit today! | | | | |
